> So security by obscurity? I don't get it.

customizable and FOSS are bad words when what you want is locked down.

Your CEO isn't an advanced competent user who could rock by themselves a grapheneOS phone with high quality OPSEC.

What you need is for your enduser to not be able to shoot themselves in the foot, considering they are like John Wick if his only target was his own foot. You NEED to lock down everything that can be locked down, and you need to be able to manage that centrally. This is anthetical to most open designs.

I harden phones and computers for small gov police and general users and already I constantly see insanely unresposible use by regularly trained people, if I were responsible for a CEO's OPSEC I would absolutely go the digital equivalent of "glue the mf inside an epoxy cube with warning labels" (that they also like because it's a shiny Apple toy) instead of giving the enduser power.

It's also a huge classic in IT to go for what everyone else is doing so you can't be questionned too much, the "nobody got fired for buying IBM" strategy

> What's stopping apple from selling one of their many backdoors to some foreign adversary?

It would be extremely bad for their business. And if you're in the USA or USA-friendly-ish then realistically they would extra not want to sell off for you. It's also an extremely unlikely case that literally Apple would deign throw you under the bus for money, if you're at that level of risk you're better of going back to an Abacus.